Smartphone App Secretly Logs Usage

Thursday, December 1, 2011 @ 08:12 PM gHale

Millions of smartphones are secretly monitoring key presses, geographic locations, and received messages of its users, an Android app developer said.

In a YouTube video posted on Monday, Trevor Eckhart showed how software from a Silicon Valley company known as Carrier IQ recorded in real time the keys he pressed into a stock EVO handset, which he had reset to factory settings just prior to the demonstration. Using a packet sniffer while his device was in airplane mode, he demonstrated how each numeric tap and every received text message ends up logged by the software.

Eckhart then connected the device to a Wi-Fi network and pointed his browser at Google. Even though he denied the search giant’s request that he share his physical location, the Carrier IQ software recorded it. The app then recorded the precise input of his search query – again, “hello world” – even though he typed it into a page that uses the SSL, or secure sockets layer, protocol to encrypt data sent between the device and the servers.

“We can see that Carrier IQ is querying these strings over my wireless network [with] no 3G connectivity and it is reading HTTPS,” Eckhart said.

Eckhart posted the video four days after Carrier IQ withdrew legal threats for calling its software a “rootkit.” The Connecticut-based programmer said the characterization is accurate because the software obscures its presence by bypassing typical operating-system functions.

In an interview last week, Carrier IQ VP of Marketing Andrew Coward rejected claims the software posed a privacy threat because it never captured key presses.

“Our technology is not real time,” he said. “It’s not constantly reporting back. It’s gathering information up and is usually transmitted in small doses.”

Eckhart said he chose the HTC phone purely for demonstration purposes. Blackberrys, other Android-powered handsets, and smartphones from Nokia contain the same snooping software, he said.